3

I need to be notified exactly when an application start LISTENING on any/specified TCP port.

is there anything like

  1. configuring an application to log this event
  2. using a library in any programming language(C/C++ is preferred), so that it provides ability to stands in the middle and log this event
  3. or any other idea, EXCEPT watching netstat or watching SYN packet received in any way (tcpdump, iptable, ...)
1
  • 1
    Use the audit daemon for this. man auditctl.
    – Jenny D
    Aug 29, 2015 at 14:42

1 Answer 1

4

You can do this using auditd; ask it to audit all calls to bind(2) and listen(2) -- the former so you can see what port is being bound to, and the latter to know when the listening starts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .